PreEmptive Protection Tackles Top Developer Compliance Complaints

May 7, 2019 1407 Views Erica Kurfis

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

Seattle, WA. Microsoft Build Conference, May 7, 2019 - PreEmptive announced today the immediate availability of Dotfuscator Professional 4.41 and DashO 10.0 Beta. These updates to the PreEmptive Protection suite reduce initial protection configuration effort by 90% and offer complete automation of many of the most sophisticated runtime controls entirely. In a just-completed developer survey incorporating responses from over 315 organizations, 77% reported that “confusion around regulatory requirements slows innovation” while 71% stated that “the cost and complexity of compliance” is making it harder to compete.

Development organizations must find ways to meet complex privacy and compliance requirements even as they are under increasing pressure to deliver high quality, innovative features across platforms and devices.

“These releases demonstrate PreEmptive’s commitment to deliver powerful app and data security controls without unnecessary development overhead or an army of consultants.“ – Gabriel Torok, CEO PreEmptive

Dotfuscator Professional 4.41 offers an entirely new way of configuring and integrating Dotfuscator into automated build environments - installed on-demand, activated as part of the build, and run the same way as it is in development. The result is a 90%+ reduction in time and effort required to configure and integrate Dotfuscator into your preferred pipeline. “While these tools improve any CI build, they really shine with dynamic build agents - build agents that are provisioned on-demand - like in Azure Pipelines," said Nathan Arthur, Engineering VP, PreEmptive.

Dotfuscator 4.41 includes:

A NuGet package that can be deployed into a private artifact repository (e.g. Azure Artifacts) and dynamically installed via nuget install,
Dynamic licensing via a new "Floating" license model combined with flexible Dotfuscator activation options using command line arguments, environment variables, or MSBuild properties, and
A separately-released Azure Pipelines extension.

Another major innovation, Dotfuscator Visual Studio project file integration, further reduces time away from building new features and fixing bugs and supports all project types including Xamarin and early versions of Blazor and .NET Core 3.

“Taken together, these enhancements typically reduce configuration and implementation efforts by over 90%.” – William Leach, CTO, PreEmptive

DashO 10.0 Beta is the first application hardening solution to fully leverage R8, Google’s recently introduced Android app shrinker. R8 replaces ProGuard, an earlier shrinker and obfuscator. DashO 10.0 is currently in beta and is distributed with a Go Live license.

“DashO 10.0 takes a typical migration from ProGuard from hours to just a few minutes.” William Leach, CTO, PreEmptive

In addition to obfuscation transformation algorithms, DashO Android Mode also offers:

Tamper detection and defense,
Rooted device detection and response,
Anti-debugger controls,
Emulator detection and response, and
Anti-hooking controls.

Whether mobile, desktop or cloud, PreEmptive Protection’s powerful application and data protection controls can be implemented without any dependency on third-party APIs, changes to application source code or even a connection to a network.

“PreEmptive’s post-compile injection capabilities are also ideally suited to generate auditable logs and to meet specific offline requirements from organizations like the PCI Council and general guidelines from regulations like GDPR,” concluded Sebastian Holst, CSO, PreEmptive.

Latest Blog Posts

Announcing the DashO v10.2 Release with Resource Encryption for Android

The DashO 10.2 release introduces a major new feature: Resource Encryption for Android. It's currently in beta, but is fully supported for production use. It allows you to encrypt the resources embedded in your APK, better protecting your Android application against static attacks.

This functionality integrates directly with your existing Gradle build, encrypting the resources during the standard build process. DashO then injects code into your protected application that will decrypt those resources at runtime.

Resource Encryption is off by default, but can be easily enabled in the DashO UI. The UI makes it easy to enable, or disable, the encryption of specific resources via drag and drop. It currently supports encrypting both assets and raw resources.

Once you install DashO 10.2, using this feature is easy.

Today we're announcing the first new major-version release of Dotfuscator in thirteen years: Dotfuscator Professional 6.0 Beta. It's an exciting new release with major new capabilities, but before we get into that, let's take a look at why it's been so long since we had a major release and why we're choosing to do one now.

For development teams, adding Dotfuscator to a build pipeline can often seem like a challenge; the value it adds is mostly gained by the surrounding business, and the cost of adding it is mostly borne by the development team. We understand that constraint, which is why we focus on making Dotfuscator as easy to integrate and maintain as possible. If you're a long-time user of Dotfuscator, you've probably experienced that - release after release of painless upgrades. That's our "first do no harm" philosophy in action.

The dynamic type in C# provides flexibility that is not available in other statically-typed languages. Since its introduction in C# 4.0 (.NET 4.5), we have worked with customers who wanted to know more about how dynamic types are impacted by the obfuscation process.

Malicious actors — like any thieves — live by a simple rule: If the front door is locked, break the window.

It’s why threats like fileless malware and crypto-jacking have seen substantial gains over last few years. It’s why — despite increasing employee education and IT training — hackers are still hooking phish by developing more sophisticated and authentic-looking email spoofs. Cybercriminal communities, meanwhile, continue to grow on the dark web, allowing attackers to share info, purchase exploit kits and identify potential targets.

What does this mean for CISOs? That typical defense efforts are being outpaced as familiar attack vectors are replaced with non-traditional threats. But it’s not all bad news; here are three questions every CISO needs to ask to help close the doors, bolt the windows and leave hackers out in the cold.

Gabriel, you have been in the security industry for over 2 decades. You have seen many different tools and services. Why create a company around something as specific as obfuscation and in-app protection?

Our customers build a lot of really innovative apps that enable their users and customers to do new and cool things. These apps frequently run on untrusted client computers/devices and they control access to customer’s sensitive data or critical devices.

And after all the effort of designing, building, debugging, and deploying their applications, the last thing they want is for an attacker to steal their work or use it to look for vulnerabilities to break into their system.

Long ago, we built a Java code optimizer, but it became clear to us that our customer cared more about the obfuscation effects of the optimization than the actual performance improvement. That is when we really began to focus on app protection. First with Java, then .NET, Android, iOS, Xamarin, JavaScript, etc.

PreEmptive Protection Tackles Top Developer Compliance Complaints

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

Announcing the DashO v10.2 Release with Resource Encryption for Android

Dotfuscator 6.0 Beta: Entering the Next Era of Dotfuscator

Protecting C# Applications That Use Dynamic Types

Non-Traditional Attack Vectors: Three Questions Every CISO Needs to Ask

Q&A With PreEmptive CEO Gabriel Torok

Gabriel, you have been in the security industry for over 2 decades. You have seen many different tools and services. Why create a company around something as specific as obfuscation and in-app protection?

Latest Blog Posts

Announcing the DashO v10.2 Release with Resource Encryption for Android

Dotfuscator 6.0 Beta: Entering the Next Era of Dotfuscator

Introducing JSDefender: PreEmptive Protection now includes JavaScript

Protecting C# Applications That Use Dynamic Types

Non-Traditional Attack Vectors: Three Questions Every CISO Needs to Ask

Twitter